- X-Pack Reference for 6.0-6.2 and 5.x:
- Introduction
- Setting Up X-Pack
- Breaking Changes
- X-Pack APIs
- Graphing Connections in Your Data
- Profiling your Queries and Aggregations
- Reporting from Kibana
- Securing the Elastic Stack
- Getting Started with Security
- How Security Works
- Setting Up User Authentication
- Configuring SAML Single-Sign-On on the Elastic Stack
- Configuring Role-based Access Control
- Auditing Security Events
- Encrypting Communications
- Restricting Connections with IP Filtering
- Cross Cluster Search, Tribe, Clients and Integrations
- Reference
- Monitoring the Elastic Stack
- Alerting on Cluster and Index Events
- Machine Learning in the Elastic Stack
- Troubleshooting
- Getting Help
- X-Pack security
- Can’t log in after upgrading to 6.2.4
- Some settings are not returned via the nodes settings API
- Authorization exceptions
- Users command fails due to extra arguments
- Users are frequently locked out of Active Directory
- Certificate verification fails for curl on Mac
- SSLHandshakeException causes connections to fail
- Common SSL/TLS exceptions
- Internal Server Error in Kibana
- Setup-passwords command fails due to connection failure
- X-Pack Watcher
- X-Pack monitoring
- X-Pack machine learning
- Limitations
- License Management
- Release Notes
WARNING: Version 6.2 of the Elastic Stack has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Index Action
editIndex Action
editUse the index
action to index data into Elasticsearch.
See Index Action Attributes for the supported attributes.
Configuring Index Actions
editThe following snippet shows a simple index
action definition:
"actions" : { "index_payload" : { "condition": { ... }, "transform": { ... }, "index" : { "index" : "my-index", "doc_type" : "my-type", "doc_id": "my-id" } } }
The id of the action |
|
An optional condition to restrict action execution |
|
An optional transform to transform the payload and prepare the data that should be indexed |
|
The elasticsearch index to store the data to |
|
The document type to store the data as |
|
An optional |
Index Action Attributes
editName | Required | Default | Description |
---|---|---|---|
|
yes |
- |
The Elasticsearch index to index into. |
|
yes |
- |
The type of the document the data will be indexed as. |
|
no |
- |
The optional |
|
no |
- |
The field that will store/index the watch execution time. |
|
no |
60s |
The timeout for waiting for the index api call to return. If no response is returned within this time, the index action times out and fails. This setting overrides the default timeouts. |
|
no |
- |
Optional setting of the refresh policy for the write request |
Multi-Document Support
editLike with all other actions, you can use a transform to replace the current execution context payload with another and by that change the document that will end up indexed.
The index action plays well with transforms with its support for the special _doc
payload field.
When resolving the document to be indexed, the index action first looks up for a
_doc
field in the payload. When not found, the payload is indexed as a single
document.
When a _doc
field exists, if the field holds an object, it is extracted and indexed
as a single document. If the field holds an array of objects, each object is treated as
a document and the index action indexes all of them in a bulk.
An _index
, _type
or _id
value can be added per document to dynamically set the ID
of the indexed document.